CVE-2023-53634

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, arm64: Fixed a BTI error on returning to patched function<br /> <br /> When BPF_TRAMP_F_CALL_ORIG is set, BPF trampoline uses BLR to jump<br /> back to the instruction next to call site to call the patched function.<br /> For BTI-enabled kernel, the instruction next to call site is usually<br /> PACIASP, in this case, it&amp;#39;s safe to jump back with BLR. But when<br /> the call site is not followed by a PACIASP or bti, a BTI exception<br /> is triggered.<br /> <br /> Here is a fault log:<br /> <br /> Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI<br /> CPU: 0 PID: 263 Comm: test_progs Tainted: GF<br /> Hardware name: linux,dummy-virt (DT)<br /> pstate: 40400805 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c)<br /> pc : bpf_fentry_test1+0xc/0x30<br /> lr : bpf_trampoline_6442573892_0+0x48/0x1000<br /> sp : ffff80000c0c3a50<br /> x29: ffff80000c0c3a90 x28: ffff0000c2e6c080 x27: 0000000000000000<br /> x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000050<br /> x23: 0000000000000000 x22: 0000ffffcfd2a7f0 x21: 000000000000000a<br /> x20: 0000ffffcfd2a7f0 x19: 0000000000000000 x18: 0000000000000000<br /> x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffcfd2a7f0<br /> x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000<br /> x11: 0000000000000000 x10: ffff80000914f5e4 x9 : ffff8000082a1528<br /> x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0101010101010101<br /> x5 : 0000000000000000 x4 : 00000000fffffff2 x3 : 0000000000000001<br /> x2 : ffff8001f4b82000 x1 : 0000000000000000 x0 : 0000000000000001<br /> Kernel panic - not syncing: Unhandled exception<br /> CPU: 0 PID: 263 Comm: test_progs Tainted: GF<br /> Hardware name: linux,dummy-virt (DT)<br /> Call trace:<br /> dump_backtrace+0xec/0x144<br /> show_stack+0x24/0x7c<br /> dump_stack_lvl+0x8c/0xb8<br /> dump_stack+0x18/0x34<br /> panic+0x1cc/0x3ec<br /> __el0_error_handler_common+0x0/0x130<br /> el1h_64_sync_handler+0x60/0xd0<br /> el1h_64_sync+0x78/0x7c<br /> bpf_fentry_test1+0xc/0x30<br /> bpf_fentry_test1+0xc/0x30<br /> bpf_prog_test_run_tracing+0xdc/0x2a0<br /> __sys_bpf+0x438/0x22a0<br /> __arm64_sys_bpf+0x30/0x54<br /> invoke_syscall+0x78/0x110<br /> el0_svc_common.constprop.0+0x6c/0x1d0<br /> do_el0_svc+0x38/0xe0<br /> el0_svc+0x30/0xd0<br /> el0t_64_sync_handler+0x1ac/0x1b0<br /> el0t_64_sync+0x1a0/0x1a4<br /> Kernel Offset: disabled<br /> CPU features: 0x0000,00034c24,f994fdab<br /> Memory Limit: none<br /> <br /> And the instruction next to call site of bpf_fentry_test1 is ADD,<br /> not PACIASP:<br /> <br /> :<br /> bti c<br /> nop<br /> nop<br /> add w0, w0, #0x1<br /> paciasp<br /> <br /> For BPF prog, JIT always puts a PACIASP after call site for BTI-enabled<br /> kernel, so there is no problem. To fix it, replace BLR with RET to bypass<br /> the branch target check.